Mo, have you done a test with api 2.8 ?
2.8 identity manager works great for secure services, even if the service is used for find/query.someone correct me if I'm wrong, but the only change to your code is to add:
dojo.require("esri.IdentityManager");
var facils = new esri.layers.FeatureLayer("https://mydomain.com/ArcGIS/rest/services/secured/0",{
mode:esri.layers.FeatureLayer.MODE_ONDEMAND,
outFields:["*"]
});